CVE-2011-0771 The Janrain Engage (formerly RPX) module 6.x-1.3 for Drupal does not validate the file for a profile image, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks and po...
MediumCVSS 6.8
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Janrain Engage (formerly RPX) module 6.x-1.3 for Drupal does not validate the file for a profile image, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks and possibly execute arbitrary PHP code by causing a crafted avatar to be downloaded from an external login provider site.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| janrain rpx | = 6.x-1.3 | No fix listed |
References
- drupal.org patch vendor-advisory
- 70623 vdb-entry
- 42980 third-party-advisory vendor-advisory
- 45926 patch vdb-entry
- janrain-unspecified-xss(64847) vdb-entry
- janrain-file-upload(64848) vdb-entry